A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. (CVE-2026-111984)

CVE-2026-111984 describes a cross-site scripting vulnerability in AUTOMATIC1111 stable-diffusion-webui versions up to 1.10.1. The flaw is located in the create_item_html function within the modules/ui_extra_networks.py file, specifically in the Card Builder component. Manipulation of the filename argument allows remote attackers to inject and execute arbitrary scripts in the context of the affected application. The vulnerability has been publicly disclosed, but the project has not yet issued a fix or official advisory. The CVSS v3.1 base score is 4.3, reflecting a low-severity issue with network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on integrity only.

The vulnerability allows remote attackers to perform cross-site scripting attacks by manipulating the filename argument. This can lead to limited integrity impact such as script injection and potential UI manipulation. There is no impact on confidentiality or availability according to the CVSS vector. The exploit has been publicly disclosed, which may increase the risk of exploitation, but no known active exploitation in the wild has been reported.

As of the publication date, no official fix or patch is available from the project. Users should monitor the project’s official channels for updates and patches. In the meantime, consider implementing input validation or sanitization on the filename parameter if possible, or restrict access to the vulnerable component to trusted users only. Avoid exposing the vulnerable interface to untrusted networks until a patch is released.